Auditing-as-a-service

Abstract

Auditing information is captured from a processing stack of an invoked application. An annotation customized for that invocation context is processed to filter and/or add additional audition information available from the processing stack. The customized auditing information is then sent to a destination based on a processing context of the invoked application when the invoked application completes processing. In an embodiment, the customized auditing information is housed in a data store and an interface is provided for customized query processing, report processing, event processing, a notification processing.

The invention claimed is: 
     
       1. A method, comprising:
 identifying an expression linked to an application invoked within a processing context on a server; 
 obtaining first data from a processing stack associated with the application; 
 processing the expression with the first data; 
 obtaining second data from the processing stack based on the processing; 
 maintaining the second data in an object that is accessible to other resources after the application exits processing; 
 sending the second data to an auditing microservice for indexing and storing in a centralized data store; 
 parsing the expression using the first data to obtain the second data that includes custom audit data and identifying the custom audit data from the processing stack for the processing context, the custom audit data being defined by an annotation associated with the application; 
 performing a searching, reporting, and mining through an audit interface of the centralized data store by indexing the custom audit data within the centralized data store; and 
 sending a reference to the object to a resource after the application exits processing from the processing context. 
 
     
     
       2. The method of  claim 1  further comprising, sending the second data to a resource based on the processing context. 
     
     
       3. The method of  claim 1  further comprising, providing an interface for searching the centralized data store. 
     
     
       4. The method of  claim 1  further comprising, assigning one or more categories to the second data. 
     
     
       5. The method of  claim 4  further comprising, sending portions of the second data to a resource based on the one or more categories. 
     
     
       6. The method of  claim 1  further comprising, processing the method as a service to additional applications. 
     
     
       7. The method of  claim 1  further comprising, providing the object as a trace log of the application within a processing context associated with processing a transaction. 
     
     
       8. The method of  claim 1 , wherein identifying further includes detecting the expression based on invocation of the application within the processing context. 
     
     
       9. The method of  claim 1 , wherein identifying further includes initiating the identifying in response to a call made by the application to the method. 
     
     
       10. A method, comprising:
 associating an expression with an application; 
 detecting an invocation of the application on a processing stack within a processing context on a server; 
 processing the expression and obtaining audit data for the application from the processing stack for the processing context; 
 retaining the audit data in an object after the application exits processing within the processing context in an audit data store; 
 categorizing portions of the audit data and sending each portion of the audit data to a certain resource associated with a corresponding assigned category, wherein categories are defined by an annotation associated with the application, and wherein the audit data includes metadata for an invoking application, metadata for an invoked application, an operation endpoint, an operation result, data for an invoking end user, data about the certain resource, additional invocation metadata, classification data for an audit content, and any ad-hoc user defined data, 
 parsing the expression to obtain data types and patterns of data defined for the audit data from the processing stack; 
 performing a searching, reporting, and mining through an audit interface of the audit data store by indexing the audit data within the audit data store; and 
 sending a reference to the object to a resource after the application exits processing from the processing context. 
 
     
     
       11. The method of  claim 10 , wherein processing further includes parsing the expression to obtain data types and patterns of data defined for the audit data from the processing stack. 
     
     
       12. The method of  claim 10  further comprising indexing the audit data within the audit data store for searching, reporting, and mining through an audit interface of the audit data store. 
     
     
       13. The method of  claim 10 , wherein retaining further includes retaining other audit data captured for the application with the audit data within the audit data store. 
     
     
       14. The method of  claim 10 , wherein associating further includes initiating the method based on an application identifier associated with the application appearing on the processing stack within the processing context. 
     
     
       15. The method of  claim 14 , wherein initiating further includes obtaining the expression based on an annotation identifier for the application being linked to the expression. 
     
     
       16. A system, comprising:
 a cloud that comprises at least one server and the at least one server comprises at least one processor having instructions; and 
 the instructions when executed by the at least one processor cause the at least one processor to perform operations comprising: 
 identifying an annotation associated with an application that is invoked within a processing context on the at least one server; 
 obtaining an expression for custom audit data based on the annotation; 
 obtaining first audit data from a processing stack for the processing context of the application; 
 obtaining the custom audit data by parsing the expression using the first audit data and identifying the custom audit data from the processing stack for the processing context; 
 storing the first audit data and the custom audit data in an audit data store, wherein the custom audit data includes metadata for an invoking application, metadata for an invoked application, an operation endpoint, an operation result, data for an invoking end user, data about a target resource, additional invocation metadata, classification data for audit content, and any ad-hoc user defined data; 
 retaining the custom audit data in an object that persists after the application exits processing from the processing context; 
 searching the audit data store by utilizing an interface, and performing customized query processing, report processing, event processing, and notification processing based on the custom audit data by utilizing the interface; and 
 sending a reference to the object to a resource after the application exits processing from the processing context.